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Abstract 

Using a multidimensional large sieve inequality, we obtain a bound 
for the mean square error in the Chebotarev theorem for division fields 
of elliptic curves that is as strong as what is implied by the Generalized 
Riemann Hypothesis. As an application we prove a theorem to the effect 
that, according to height, almost all elliptic curves are Serre curves, where 
a Serre curve is an elliptic curve whose torsion subgroup, roughly speaking, 
has as much Galois symmetry as possible. 



1 Introduction. 

Let E be an elliptic curve defined over Q and denote by 

(j>N,E ■■ Gq Aut{E[N]) 

the representation of Gq := Gal(Q/(Q)) on the A^-torsion of E. Fixing a IjlSSI- 
basis of E{N\, we identify Aut(£'[A]) with GL2[1/N'L) and write 

(^N,E ■■ Gq GL2{Z/NZ). 

The image 0jv,_e(Gq) is exactly the Galois group of the Nth division field of 
E over Q, i.e. the field obtained by adjoining to Q the x and y coordinates 
of the A^-torsion of a given Weierstrass model of E. Taking the inverse limit 
over all A > 1 with the bases chosen compatibly, we obtain the full torsion 
representation 

(t>E ■■Gq'^ Gi2(Z) := limGL2(Z/AZ). 

It is natural to wonder how large the image of (j)E in Gi2(Z) is. 

Definition 1. The integer N is said to be exceptional for E if 4>n,e is not 
surjective. 

To wonder about the size of the image oi 4>e in GL2{Z) is simply to wonder 
about which numbers A are exceptional for E^ and about "how exceptional each 
A is," i.e. about the index [GL2(Z/AZ) : (l)N,E{Gq)\. 

When E has complex multiplication, every A except possibly A = 2 is 
exceptional, and so the image 4>e{Gq) has infinite index in GL2(Z). On the 
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other hand, when E does not have CM, Serre [TS] has shown that the index 
[GL2(Z) : (j){Gq)] is finite. Equivalently, there exists an integer so that 

<Pe{Gq) = Tr^^{(l)nE,E{GQ)), (1) 

where tt : GL2(Z) GL2(Z/n£;Z) is the natural projection. In particular, this 
implies that any fixed elliptic curve E has only finitely many exceptional primes, 
since any such exceptional prime must divide ue- One might wonder how the 
integer ue (chosen minimally so that ^ still holds) depends on the curve E. 
Various results exist which bound the largest possible exceptional prime for E. 
For example, Mazur [T3j proves that if E is semistable then no prime > 11 
can be exceptional for E. 

Define the height H{E) of the elliptic curve by 

=max(|r|Ms|2), 

where r and s are the unique integers so that E has a model of the form = + 
rx + s and gcd(r^,s^) is twelfth-power free. Duke J\ shows that, when counted 
according to height, almost all elliptic curves have no exceptional primes. Stated 
precisely, he shows that if 

G{X) ;= { isomorphism classes elliptic curves E over Q : H{E) < X^} 

and e{X) is the set oi E E C{X) which have at least one exceptional prime, 
then 

He does this by using a two-dimensional large sieve inequality to prove a result 
which bounds the mean-square error in the Chebotarev density theorem for the 
A^th division fields of E over curves of bounded height. Using this, he shows 

|e(X)| <XMog^X 

with an absolute (but ineffective) constant. Since 

G{X) = + 0{X^) (3) 

(c.f. [T]), this implies 

In [TT], Grant obtains an asymptotic formula for e{X). He shows that the 
curves which are exceptional at the primes 2 and 3 contribute the main term of 
|e(X)|, and that, for an explicit constant C, 

\eiX)\=CX'^ + 0{X^+'). 

for all e > 0. 

This paper gives a different generalization. The statement that an elliptic 
curve E has no exceptional primes may be viewed as saying that the Galois 
representation (j)E has "large image." In this paper we extend ([2]) to a result 
that almost all elliptic curves have (/'_e(Gq) "as large as possible." 
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3 Statement of Results. 

Our main result is a theorem bounding the mean-square error in the Chebotarev 
theorem for division fields of elliptic curves. Fix a positive integer level N and 
a conjugacy class 

C c GL2iZ/NZ). 

We denote by 

tte{X;N,C) := \{p < X : (j)N.E(Frohp) C C}\ 

the function which counts the number of primes up to X which are unramified 
in Q{E[N]) and whose Frobenius class is contained in C, and as usual 

n{X;N,d) = \{p<X -.p-d mod A^}|. 

Theorem 2. For X > 1, one has 

where fiN) denotes the Euler-phi function, and the implied constant is absolute. 

In [7], Duke proves this (without the factor) for prime level N and the 
where the conjugacy class C is replaced by a set of the form 

Gt^d ■■= {A e GL2iZ/NZ) : trA = t, detA = d} 

Such sets are unions of conjugacy classes. For example, even when N is prime, 
the set G'2A,A2 contains two conjugacy classes, represented by the matrices 

A 0\ J fx 1 

x) ^""^ [o X 

respectively. Theorem [2] distinguishes between these two cases. 

Our second result is an application of this theorem to the problem of counting 
elliptic curves E for which (psiGq) is as large as possible. First of all, how large 
can this image be? Does there exist an elliptic curve E with (j)^ surjective? In 
other words, is there a curve E with = 1? Serre jl5] answers no. For each 
elliptic curve E, there is an index two subgroup He ^ 6*^2 (^) (for a precise 
definition, see section [51) so that 

C He. (4) 
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Definition 3. We call an elliptic curve E a Serre curve when equality holds in 
©• 



Our second theorem is 
Theorem 4. Let Cserre{X) denote the set 

{E G C{X) : E is a Serre curve }. 

Then, 

y \Cserre{X)\ _ 
i™oo \C{X)\ ~ 

In order to obtain tliis result tiiat "almost all elliptic curves are Serre curves" , 
we prove an algebraic lemma which gives a sufficient condition on an elliptic 
curve to be a Serre curve. 

Lemma 5. Suppose E over Q is an elliptic curve such that 

1. E has no exceptional primes. 

2. E is not exceptional at A or 9. 

3. The index [GL2(Z/8Z) : 08,_e(Gq)] 7^ 2. 

4-. There is a prime number p > 3 which divides the Serre number Af^^j,^^;) 
(For the definition of the Serre number M^^^(^^'^, see section\^. 

Then, E is a Serre curve. 

This lemma is used together with Theorem [5] to give Theorem 31 In a 
subsequent paper we plan to use Theorem [J] to compute the average value over 
elliptic curves of the Lang- Trotter constants, answering a question of David and 
Pappalardi [S]. 

The paper is organized as follows: in section [4] we prove Theorem [2] Section 
[5] gives the complete definition of a Serre curve, and section [6] devotes itself to 
a proof of Lemma El Finally in section [71 we prove Theorem (H and in section 
m we produce an example of a one-parameter family of elliptic curves which are 
exceptional at iV = 4 but not at iV = 2. 



4 Bounding Mean-Square Chebotarev error. 

In this chapter we prove Theorem |2l We first remark that although it gives a 
bound as strong as the appropriate Generalized Riemann Hypothesis, the proof 
is unconditional. It employs the following large sieve inequality of Gallagher 
(see Lemma A of [10 ) and follows along the same lines as the proof of Theorem 
2 of [7]. 
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Lemma 6. For each prime number p let ^l{p) Q (Z/pZ)'^ be any subset. For 
each fixed m G Z'^ we define 

P{X; m) ^ \{p < X : m mod p e ^{p)}\ 

and 

p{x) = J2 imip-"- 

p<X 

Let B be a box in R'^ whose sides are parallel to the coordinate planes which has 
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width W{B) and volume V{B). IfW{B) > X"^ , then 
{P{X-,m)^P{X)f^uV{B)P{X). 



We will take fc = 2 and define the set 51 (p) = ^c{p) in such a way that 
P{X] (r, s)) and P{X) will satisfy 

P{X- (r, s)) = TTB^,, {X- N,C) + OiiuiN)). (5) 

and 

respectively, where the implied constants are absolute. This implies Theorem[5J 



4.1 Defining the set Qcip) ^ {Z/pZ^. 

We begin by quoting a result of Duke and Toth which describes explicitly the 
conjugacy class in Gal (Q(i?[A^])/Q) of the frobenius automorphism at a prime 
p which is unramified in Q(£^[A'^]). The description is given purely in terms of 
data attached to Ep, the reduction of E modulo p. 

In our context, their result may be stated as follows: let Fp denote the finite 
field of p elements and Ep any elliptic curve defined over Fp. Let a = a{Ep) G Z 
be the trace of the Frobenius endomorphism (j)p of Ep and b = b{Ep) the index 
in the ring of Fp-endomorphisms of Ep of the subring generated by the frobenius 
endomorphism: 

5= [EndF,(£^p) : Z[0p]]. 

In any case (including the supersingular case), the ring End ^^(ii'p) is iso- 
morphic to an imaginary quadratic order (see Theorem 4.2 of ^19]), whose dis- 
criminant we denote by A = A(Ep). The comparison of discriminants yields 

Ab^ = - Ap. (7) 

We associate to Ep the following matrix of trace a and determinant p: 

f{a + b5)/2 b \ 

"^^P'^ [b{A-6)/4 {a-b6)/2) 

where for a discriminant A we have S — 0,1 according to whether A = 0, 1 mod 
4. Because of (O, cr has integer entries. 
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Theorem 7. Suppose the elliptic curve Ep over (Z/pZ) is the reduction modulo 
p of an elliptic curve E over Q and p is prime to N . Then p is unramified in 
Q{E[N]) and the integral matrix a defined in ([5]), when reduced modulo N, 
represents the class of the Frobenius of p in Gal ( 



Now suppose p > 3 is a prime number and for (r, s) e F^, let Er^s denote 
the curve given by the equation 

y2 ^ ^ _|_ (9) 

and Ar,s = — 16(4r^ + 27s^) the associated discriminant. For any conjugacy 
class C C GL2(Z/7VZ) we define rJc(2) = l^c(3) = and for p > 3, 

nc{p) := {(r, s) e : A^,^ ^ and a{E.r^s) mod N e C}. 



Since the discriminant A^.s of the curve Er.s is related to its minimal discrimi- 
nant A by 

A 

for some e dividing 6, we see from Theorem [7] that ([5]) holds. We now turn to 
verifying 

4.2 The asymptotic in p of 

The goal of this section is to give the asymptotic of |ric(p)| as p ranges through 
the set of prime numbers for which Qcip) 7^ 0- Our proof will show that in fact, 

ndp) p = det C mod N. 

Theorem 8. For p prime congruent to detC modulo N we have 

where the implied constant is absolute. 

We observe that ^ follows upon partial summation. Thus, Theorem will 
follow from Theorem [S] 

To prove Theorem |51 we first express |ric(p)| in terms of a weighted class 
number. Define the set 

Tcip) := {A e M2x2{Z) ■■ dctA = p,A mod TV e C}, 

and the subset of elliptic matrices 

Tt?{p) := {A e Tcip) : (tr Af - idctA < 0}. 

Since C is stable by S'i2(Z/^Z)-conjugation, both of the above sets are stable 
by 5'L2(Z)-conjugation. 

Note: Throughout the rest of this paper we will use the standard notation 

r(l) SL2iZ). 
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Proposition 9. 



2 ^ irfilal' 

aGr<f(p)//r(i) I ^ ^"1 
where T^{p) //r(l) is t/ie sei of T (I) -conjugation orbits in T^{p) and 

r(i)„ :={7er(i) : 7^ = 07}. 

This proposition, together with the following lemma, imply Theorem [8l 
Lemma 10. If p = detC mod N then 

^ |r(i),| \SL2(z/NZ)r ^ ^ 

wii/i an absolute constant. 

Proof This is Corollary 8 of [12] □ 

The remainder of this section is devoted to proving Proposition [9l We note 
that 

^c{p) = {ir,s) e {Z/pZf : A,,, ^ and e Tc%p)}. 

At this point we must give a finer description of C. For any divisor M of N and 
integers T, I? modulo N/M, define 

Tn/m{T,D) ^{Ae M2x2(Z/(iV/M)Z) : (tr A, det A) = {T,D) mod N/M} 
and 

'^N/MCr,D) = {AeTN/M{T,D) : A is non-scalar mod each prime I \ N/M}. 

The following lemma is a corollary of Proposition 7 of [12] describing the struc- 
ture of conjugacy classes in the group GL2{1i/N'L). 

Lemma 11. Any conjugacy class 

C c GL2iZ/NZ) 

has the form 

C = \I + MT^^m{T,D), 
where A is an integer satisfying < A < M. 

We would like to partition T^{p) into subsets which are stable by r(l)- 
conjugation. Let T*{T,D, f) denote 

J)eAf2x2(Z): trA = T, detA = i:>, gcd(6,d-a,c) = /}. 



We note then that the trace t and determinant d of any matrix in the set 
XI + MT*{T,DJ) satisfy 

t^2X+MT, d = \^+MXT+M^D, and -M = M'^ {T'^ - iD) . (10) 
Thus, from Lemma [TT] we see that 

^C(P)= U U {XI + MT*{T,DJ)), 

(T.D) f>l 

gcd(/,JV/M) = l 

where (T, D) runs over integer pairs satisfying 

(T, D) = {T,D) mod N/M, p ^ X^ + MXT + M^D, and (2A + MT f < 4p. 
Defining n* (A, M, T,DJ) by 

{(r,s) e {Z/pZf : Ar,s + and a(Er,,) e XI + MT*{T,DJ)}, 
Proposition [9] is reduced to showing that 

\n*{X,M,T,DJ)\ = P^ ^ — i^. (11) 

ae{\I+MT*{T.D,f)) //r{l) ' ^ 

Lemma 12. n*{X,M,T,DJ) is equal to 

{(r, s) e {Z/pZy : Ar^s ^ 0, b{Er,s) = M/ arid a(i^r,s) 2A + MT}. 

Proof. The containment ''Q*{X, M,T, DJ) C ..." is immediate from dH) and 
(fTO|). The reverse containment comes from the fact that, for fixed t and p, the 
two equations 

t = 2A + MT and p = X^ + MXT + M^D 

have a unique solution (A, T, Z?) G {0, 1, . . . , A/ — 1} x Z^, if they have one at 
aU. This fact is immediate when M is odd. If M is even, we see from the first 
equation that the onfy way two distinct solutions can exist is if one solution 
looks like (A, T, D) with A G {0, 1, ... , M/2 — 1} and the other solution has the 
form (A + M/2, T — 1, D') for some integer D' . But then the second equation 
gives us the contradiction that 

X^ + MXT-p=Q mod and A^ + MAT-p ee — (1 - 2T) mod M^. 

□ 

We now summarize some fundamental facts about imaginary quadratic or- 
ders. More details may be found, for example, in §7 of 3J. An imaginary 
quadratic order O is a subring (containing 1) of an imaginary quadratic field 
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K which contains a basis of K over Q and has rank 2 as an free abeUan group. 
For each negative number A satisfying 

A = or 1 mod 4, 

there is a unique imaginary quadratic order of discriminant A, which we will 
denote by ©(A). Orders ©(A') which contain a given order 0(A) are exactly 
those orders whose discriminant A' satisfies 

/2A' = A, [O(A') :0(A)]. 

Every imaginary quadratic order O is contained in a unique maximal imaginary 
quadratic order 

O C 0„ax = Ok C K, 

which is the ring of integers of K. The ideal class group C(0) is the group 
of invertible fractional ideals of O modulo the subgroup of principal fractional 
ideals. This is a finite group whose size we denote by h{0). 

Lemma 13. Suppose p > 5 is prime and t is any integer satisfying t^ < Ap. 
Let O be any imaginary quadratic order containing the order of discriminant 
t^ — Ap. The number of elliptic curves E^^s over Fp of the form which satisfy 

tr{4>p) = t and EndY^{Er.s) = O 

is given by 

where O* is the group of units of O. 

Proof. The following theorem restates Theorems 4.2 and 4.5 of [TH], specialized 
to our situation. See also [14] . which corrects a small error in the original proof. 
The original work is due to Deuring [Sj . 

Theorem 14. Let t be any integer satisfying t^ < 4p. Then the following are 
precisely the rings which occur as rings of ¥p-endomorphisms of some elliptic 
curve Ep over ¥p satisfying a{Ep) = t: 

• if t ^ 0: all complex quadratic orders containing 0{t^ — Ap); 

• ift^O: all complex quadratic orders O satisfying 

0{—Ap)cO and p\[0 

max 

Furthermore, given such an order O, the number of ¥p-isomorphism classes of 
elliptic curves Ep over ¥p satisfying 

a{Ep) = t and End^^{Ep) — O 

is equal to h{0). 
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Note that, since p > 5, every Fp-isomorphism class contains an elliptic curve 
of the form ([9]). By the theorem, the proof of Lemma fT3l is reduced to showing 
that whenever E^^s is the form ^ with tKpp — t and 'Endf^{Er^s) — O, the 
number of elliptic curves of the same form which are isomorphic over ¥p to 
is (p — l)/!^?*!. Such elliptic curves are exactly those given by the equations 



In case \0*\ = 2, the j-invariant j{Er^s) cannot be equal to or 1728, i.e. neither 
r nor s can be equal to zero. In this case, E^ut^g^e = -E'r(M')*,s(u')6 if and only if 
u = ±m' and we count exactly {p — l)/2 distinct Eru'i-,su<^^s. The case \0* \ — 4 
occurs exactly when O = 0{—4) — I^li] is the ring of Gaussian integers, and 
this happens only if j{Ej.,s) = 1728 and s — 0. Since 



we see by relating the discriminants that t must be even and that p = 1 mod 4. 
Choosing ip e (Z/pZ)* satisfying ip — —1, we note that in this case E^^i gy^s = 
E'r{u')i-.s{u')<^ if and only if u/u' € {±Zp,±l}, and so there are again exactly 
{p — 1)710*1 elliptic curves of the form ^ isomorphic over ¥p to -E^.s- The 
j{Er^s) — case is quite similar, so we omit it. This finishes the proof of 



Returning to the verification of (fTT|) . we see by the two lemmas and (jlOp 
that 



|i7*(A,Af,r,A/)l = 




Now we use a theorem which equates the counting of weighted r(l)-orbits 
of matrices of a fixed trace and determinant (of negative discriminant) with the 
counting of weighted ideal classes in the imaginary quadratic order of the same 
discriminant. We denote by Q*(^) the set of primitive integral binary quadratic 
forms of discriminant A and Q\{/S) the subset of positive definite forms, both 
acted on by the classical r(l)-action 



By Q*(A) //r(l) and Q^(A) //r(l) we denote the corresponding orbit spaces 
under this action. 

Theorem 15. Let T and D be integers and f a positive integer satisfying 



Erui-,su<' '■ y"^ — + ru^x + su^ , u e (Z/pZ)*. 



0(<2 - 4p) C 0(-4), 



Lemma 1131 



□ 




- 4L> < 



and 



e Z, 



0, 1 mod 4. 



Then there are set bijections 




Q* 
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and 



//r(l)^C O 



P J " ' ' V V / 

Proof. We first observe that, whenever T*{T, D, f) ^ (which is equivalent to 
the three given conditions), there are unique integers T', D' and A G {0, 1, . . . , /— 
1} so that 

r*(T, D, f)^XI + fr*{T', D\ 1). 

Since - AD ^ P{{T'Y - iD'), the first bijection in the theorem is induced 
by the bijection 

r*(T', D', 1) < — > Q* {{T'f - 4D') 
given by sending the matrix ^ ^ to the form cx'^ + {d — a)xy ~ by^ and 

the form ax^ + j3xy + jy"^ to the matrix P)/"^ 'Ji)/2j ' "^^^ second 

bijection is Theorem 7.7 in [3]. □ 
We observe that for any matrix a £ T*{T, D, /), we have 

'T^ -AD" 



|r(i).| = |o 



P 



and the common value can be greater than 2 only when G {~3, —4}, 

which case h{0 {j-jr^^ ) — 1- We conclude: 

Corollary 16. 



By the corollary, ITTI) follows and we have proved Proposition [S) 

5 The definition of a Serre curve. 

We now describe the subgroup He mentioned in Definition [31 following the 
discussion proceeding Proposition 22 of 15j. Suppose that E is given by the 
equation 

= + rx + s — {x — ei){x — e2){x — 63). 

Then {61,62,63} is the set of x-coordinates of the non-trivial 2-torsion of E. 
The discriminant A of this model of E is given by 

A=((6l-62)(ei- 63)(62 -e3)f. (12) 

Thus, one has 



A) c Q(i?[2]). 
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Because of the action of Auti?[2] ~ GL2{1'/'2.'L) on the e^'s we have a group 
isomorphism between Gi2(Z/2Z) and the symmetric group on three letters: 

Gi2(Z/2Z) ~ 5*3 . 

By JH]) we see that for any Galois automorphism a e Gal {Q{E[2])/Q) C S3, 

a : y/A ^ e{a)y/A, (13) 

where e denotes the signature character on S3. In particular we note that if 
y/A e Q then 

Gal{Q{E[2])/Q) C A3 = the alternating group on 3 letters. 
In this case we define the Serre number Mi to be 2 and the Serre subgroup H2 

by 

H2 A3. 

Otherwise, Q(-\/A) is a quadratic extension, which in particular is abelian. Since 
each abelian extension of Q is contained in a cyclotomic extension, one may 
choose a positive integer D so that 



A) c Q(Cd) C QiE[D]), 

where as usual (jj denotes a primitive D-th. root of unity and the second con- 
tainment comes from the Weil pairing (c.f. [18j, for example). 

Lemma 17. Let W be any square-free integer and define the positive integer 
Dw by 

Uw\ ifW=l mod 4 
I4|W^| otherwise. 

Then we have 



'W) C (Q(Cd) ^ Dw divides D. 
Furthermore, for such a D and a e Gal{Q{E[D])/Q) C GL2{Z/DZ), we have 

a : VW ^ ( VW. (14) 

\ det cr / 

Here we use the Kronecker symbol ^ — ^ := ^ — — • JJ^ (~\ where 



:= (-l)(( )^-i)/«, and (±1) = (±1) 



p\W 
((■)-l)/2 



Proof. These are standard results from algebraic number theory, together with 
Theorem 6.6 of [17|. □ 
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By the lemma we see that 

Q(VA) C Q{Cd) ^ DA^,f divides D, (15) 

where Agf — Asf{E) is the square-free part of the discriminant A of E. For 
any square-free number W we define the "Serre number" 



Mw 



j2\W\ ifVF = l mod 4 
[4|T/F| otherwise 



to be the least common multiple of 2 and Dw- Thus in particular, Q{E[AlA^f]) 
is the compositum of Q{E[2]) and Q(£'[-Das/])- We furthermore define the 
subgroup iJAfj^- by 

Hm„ = ker f f xTTt) £{■)] C GL2{Z/MwZ), 



where here we have extended the definition of the signature character e in the 
natural way to any even level: 

e : GL2{Z/2mZ) — > GL2{Z/2Z) — > {±1}. (16) 

Later in the paper we will casually refer to "ker e" , hoping that in each instance 
its domain will be clear from context. 
By virtue of and (fT4|l . we see that 

Gal mE[MAj/Q) ^ Hm^^^^. 
The subgroup He of GL2 (Z) referred to in (j4|) is simply 

where ttm^ '■ GL2(Z) — > GL2{'Z/Ma ,2) is the natural projection. He is 
evidently an index 2 subgroup of GL2{Z) and 

C He. 

An elliptic curve i? is a Serre curve if (I)e{Gq) = He- In other words, an elhptic 
curve is a Serre curve exactly when, for every integer m, we have 

[GL,(Z/mZ) : 0„,^(Gq)] = 1^ iffA.,(^;)|m 

I 1 otherwise. 

We will refer to Hm^ ^^e^ C GL2{'Z/A{/^^^(^e)Z) (and by abuse of notation, also 
to He C GL2(Z)) as the "Serre subgroup associated to EJ^ 
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6 Which elUptic curves are Serre curves? 



If N is exceptional for E (see Definition [T|) then so is any multiple of N. 

Definition 18. We call an integer N minimal exceptional for E if it is ex- 
ceptional for E and none of its proper nontrivial divisors are exceptional for 
E. 

For example, if i? is a Serre curve, then the Serre number Af^^^^^-j (see 
section [S|) is a minimal exceptional number for E. Also, any exceptional prime 
p oi E in minimal exceptional. 

The proof of Lemma [5] uses only the theory of the groups GL2{'L/N'L) (es- 
pecially for N divisible by 2 and 3, complimenting [16]) as well as a few facts 
about cyclotomic fields. The arguments are similar to those given in Kani's 
appendix to [2]. Two separate issues arise: (1) which numbers N can actually 
occur as minimal exceptional numbers for an elliptic curve and (2) the stability 
of the Serre number M^^^(^e)- We treat them in that order. 

We will make repeated use of 

Lemma 19. The commutator subgroup (G'i2(^/p"^))' o/Gi2(^/?'"^) is given 
by 

'5i2(Z/p"Z) i/P7^2 
ker(e) n 5i2(Z/2"Z) i/p = 2 



(GL2(Z/p"Z))' = 



(see (|16p . j For p > 5, the group SL2{'Z/p'^'Z) is equal to its own commutator: 
(5L2(Z/p"Z))' = 5i2(W^) b>5). 



6.1 Minimal exceptional numbers of elliptic curves. 

The following lemma gives us a restriction on which positive integers N can 
occur as a minimal exceptional number of an elliptic curve. Throughout the 
remainder of the paper we will sometimes use the abbreviation 

Gat :=Gal(Q(£;[iV])/Q), 

suppressing the dependence on the elliptic curve E. 

Lemma 20. Let E be an elliptic curve over Q. Suppose that N Cz N is minimal 
exceptional for E. Then, 

N e { prime numbers } U {Ma^^(£;)} U {4, 8, 9}. 

If 8 is a minimal exceptional number for E , then 

[Gi2(Z/8Z) : c^eAGq)] = 2. 
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Proof. Let us assume that N is not prime. If N is exceptional for E then we 
have 

Gat C GL2iZ/NZ). 

If N is minimal exceptional, we have Gd — GL2(Z/d'Z) for each proper divisor 
d of N. Therefore the canonical map 

Gn ^ GL2{Z/dZ), Vd I N (17) 

is a surjection. By the surjectivity of the Weil pairing, we also see that the 
determinant map 

det : Gjv -» (Z/NZ)* (18) 

is surjective. We consider the question: for which composite numbers does 
there exist a subgroup Gn of GL2{Z/NZ) satisfying conditions p?| and (fT8|) ? 
We divide the investigation into cases according to whether is a prime power 
or not. We tackle the latter case first: 

Case 1: TV is not a prime power. Let p be the smallest prime divisor of N . 
Suppose p"||iV and write M :— N/p^ 1). By Galois theory we must have 

QC(Q(S[p"])nQ(£;[Af])-:i^ 

Let H = Gal (F/Q). If H is not simple, replace it by any nontrivial simple quo- 
tient, and replace F by the corresponding field. The next lemma is a corollary 
of the discussion on page IV-25 of [TB] . 

Lemma 21. If Ni and N2 are relatively prime positive integers than the groups 
GL2{Z/ NiZ) and GL2{Z/ N2Z) have no common simple nonabelian quotient. 

Since H i& a, common quotient of the groups 
Gal((Q(£:[M])/Q) = GL2(Z/A/Z) and Gal (Q(£;[p"])/Q) = GL2(Z/p"Z) 
we conclude that H is abelian. From this and Lemma [19] it follows that 

F C Q(Cm). 

If p > 2 then we must similarly have F C Q(Cp")- Since 

Q(CM)n(Q(Cp") =Q, (19) 

we conclude that _F = Q, contradicting that H is nontrivial. Therefore we must 
have p = 2. But then using Lemma [T91 we similarly conclude that 

Q^i^cQ(VA^,C2")nQ(CM). 

If n < 1 then we must have F — Q(>/Ae), and we see that iV is a multiple 
of the Serre number M^^^f^)- li n > 2 then we reason as follows: since the 
Galois group Gal(Q(V A b , C2" ) /Q) order a power of two, F must contain a 
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quadratic subfield K. By ([TO]) , we conclude that if n = 2, K must be one of the 
fields 



and if n > 3 that K must be one of the fields 



Ab), Q(V-Ab), Q(V2Ab), QW-2Ae) 



Thus in any case by (jisp . is a multiple of the Serre number of E', which 
implies that N is the Serre number of E, since N is assumed to be minimal 
exceptional. We have shown that the Serre number of E is the only minimal 
exceptional number which is not a prime power. 

Case 2: iV = p" is a prime power with n> 2. If p > 5, we reason as follows: 
Taking commutators of (jl7p we have a surjection 

{Gp,^{E)Y ~» SL2{Z/p"-^Z) = (GL2(Z/p"-iZ))'. 

By Lemma 3 on page IV-23 of 16 , this implies that (Gp^{E)y = SL2{Z/p''Z). 
But now since 

SL2{'&/p''"L) c Gp-n{E) 

we conclude by (fT8|l that Gpn{E) — GL2{'Z/p"-Z), contradicting the fact that 
p" is exceptional. We conclude that p e {2, 3}. 
Now consider the exact sequence 

1^ K ^ GL2(Z/p"Z) ^ GL2{Z/p"'-^Z) 1. 

Here K = I + p''-'^M2{I./pZ). Since Gp^ surjects onto GL2{Z/p''-^Z), we have 
the exact sequence 

1^ KDGp^ -^Gp^ ^ Gi2(Z/p""^Z) ^ 1. 

First we show that if n > 3 then 

/ + traceless matrices } C K D Gp^^ . (20) 

This is seen by choosing any preimage 

'1 



1 



of the matrix |^ ^ J G GL2{Z/p'^ Z) and observing that, if n > 3, 

I ^7')+^^""'^)'^(o ^T') ^21) 

which shows that the matrix I +p"^^ ) e A' n Gp^. Now let [ \\ be 



any matrix in GL2{Z/pZ) and choose a matrix A G Gpn{E) with 
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We then have 

Letting the matrix ^ ^ vary modulo p we see that (PO)) holds. From this 

we see that Gp^ must be an index 2 subgroup of GL2(Z/p"^)- Thus, there is a 
character 

X ■■ GL2{Z/p"Z) ^ {±1} with Gp^iE) = kerx. (22) 

By Lemma [T9l we see that if p = 3 then x factors through the determinant, i.e. 
that there is a character 

S : {Z/Tiy {±1} 

with X = ^ ° det. This implies that S'i2(Z/3"Z) C G^^^E)^ which says that 
G-in{E) — GL2(Z/3"Z) by (fT8|) . a contradiction. Thus, the only (non-prime) 
power of 3 which can be minimal exceptional for is 9. 

Now let us return to with p — 2. In this case Lemma [TOlsavs that either 
X or xe factors through the determinant, according to whether 

x((; ;))^ior-i. 

Nowifx((n ! )) = 1 then S'L2(Z/2"Z) C G2", a contradiction. Thus we must 



have x( ( n 1 ) ) ~ Therefore since x^ factors through the determinant, we 



1 
1 

^0 1 
have 

X = £-{5o det), 

where 5 : (Z/2"Z)* {±1} is a character. Now pick X = (^^ + T'-'^A G 
G21. We have detX = 1 or 1 + 2"^^. One verifies by induction that for n > 3, 

l + 2"-i = 52""' mod 2", 

so for n > 3 we must have 5{detX) = 1, contradicting (|22p . We have shown 
that for any elliptic curve E, if N ^ M/^^^(^e) is a composite minimal exceptional 
number for E, then = 4, 8 or 9, where if iV = 8 there is a real character 

X : GL2(Z/8Z) ^ {±1} 

with Gs{E) = kerx- This concludes the proof of Lemma □ 
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6.2 Stability of the Serre number Ma^^(£;)- 

Continuing the proof of Lemma[5l we will now show that under the assumptions 
stated therein, we have 

Ga/a,^ (E) = Hm^^j = the Serre subgroup (23) 

and also that for each integer N we have 

\GL2{'L/N'L) otherwise, 
where t^nm^ j denotes the natural projection 

GL2{1/NZ) — > Gi2(Z/MA,^.Z). 
We make use of the following technical lemma. 

Lemma 22. Let N > 1 be any integer which is divisible by some prime p > 5 
and by some prime p < b. Write 

N = Ni-N2 

where Ni is not divisible by any prime p > 5 and N2 is not divisible by any 
prime p < 5. Suppose that Ga C GL2{1:/N'L) is a subgroup such that 

Ga n SL2{Z/NZ) = {GL2{Z/NZ)y. 

Finally, assume Gb C Ga is a subgroup for which the canonical maps 

Gb GL2{Z/NiZ) and Gt GL2{Z/N2Z) (25) 

as well as the determinant map 

det : Gb {Z/NZ)* 

are surjections. Then Gb — Ga- 

Proof. Write A^i — 2'' 3". By we find by taking commutators that 
G'b {GL2{Z/NiZ)y = (kere n SL2{Z/2''Z)) x SL2{Z/3'Z) 

and 

G', ^ iGL2iZ/N2Z)y = SL2{Z/N2Z). 
are also surjections. We are now in a position to apply the Goursat lemma: 

Lemma 23. Let Gi and G2 be groups. Denote by Wi : Gi x G2 ^ Gi {i — 1, 2) 

the projection map. Suppose that G C Gi x G2 is a subgroup such that Tii{G) = 
Gi for i = 1,2 and define 

Hi = 7ri(G n (Gi X {62})) and H2 = 7r2(G n ({d} x G2)). 

Then, 

Gi/Hi ~ G2/H2 
and the graph of this isomorphism is induced by G. 
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We apply the lemma with d = (kere n S'L2(Z/2'^Z)) x SL2{'Llri), G2 = 
SL2{1/N2Z), andG = G'^ and conclude that (ker£nS'L2(Z/2''Z)) x S'L2(Z/3^Z) 
and S'L2(Z/7V2Z) have a common quotient group Q. If Q is nontrivial then it 
has a nontrivial simple quotient Qs- Since Lemma 1211 continues to hold with 
GL2 replaced by SL2, we see that Qs must be abelian. Since (S'L2(Z/iV2Z))' = 
S L2{Z / N2'Z) , we conclude that = 1. This shows that Q was trivial to begin 
with. We conclude that Gi = Hi and G2 = H2, i.e. that 

(Gi2(Z/iViZ))' X {1} c G;, and {1} x {GL2{Z/N2l)y C G^ 

which implies that 

Gi = (GL2(Z/iVZ))'. 
But now from the exact sequence 

1 ^ (Gi2(Z/iVZ))' ^ Ga ^ [Z/NZy 1 

and 

dct : Gb ^ {TLjNTL)* 

we conclude that (GL2(Z/A^Z))'G6 = G^. So since (GL2(Z/A^Z))' c Gb, we 
have Gh ~ Ga- □ 

Now suppose that E is an elliptic curve over Q which satisfies the hypotheses 
of Lemma [5j First we use Lemma [22] to show ((23|) . This is done by applying 
the lemma with N — Ma,,. Set Ga = Hm^ and Gj, — Ga,u (E). Write 

Ma,^ = 2''3^M' 

where M' > 1 and is co-prime to 6. To see that 

Hm. n SL2(Z/Ma^M - (kere n SL2(Z/2''3'Z)) x SLafZ/Af'Z), (26) 

we argue that the containment "C" follows from the definition of Hm^ ■ To 
see the reverse containment, we use isomorphism theorems from group theory 
and count: 

|gA/A,,l _ \GL2{Z/MA^fZ)\ 

\HM^^^r)SL2{Z/MA,^Z)\ ~ \SL2{Z/MA,fZ)\- 
Now since the index [GL2{'Z/MA,f'^) ■ H]\j^ ] = 2 we see that 

[SL2{Z/MA^fZ) : Hm^^^ H SL2{1/Ma^M - 2. 

Since the index [S'L2(Z/A/a,^.Z) : (kereH S'i2(Z/2''3"Z)) x SL2{'L/M"L)] is 
obviously equal to 2, we conclude that ([26)1 holds. 
We next verify the surjectivity conditions 

Gma., {E) ^ GL2(Z/2''3"Z) and Gm^^^ (E) ^ GL2{1/M"L). (27) 
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If the first map is not surjective, then E has some minimal exceptional number 
d which divides 2''3''. By Lemma [20l we conclude that d S {2, 3, 4, 8, Ma^j.(_e)}, 
where if d = 8 there is a specific type of exceptional subgroup occurring at 
8. However, the assumptions on E in Lemma [S] preclude these possibilities 
Therefore Gm^^^ (E) GL2(Z/2''3*Z) is surjective. Similarly, if Gma^^. (E) ^ 
GL2{Z/M'Z) is not surjective, then E has some minimal exceptional d dividing 
M'. By LemmaHni we see that d must either be a prime number or d — Ma^^(£;) . 
The assumption that E has no exceptional primes precludes the first possibility, 
and since 2 \ M' , d cannot be even and so d cannot be equal to M/^^j(^e)j which 
is always even. We have verified the conditions (|27p. Finally, the surjectivity of 

det : Gm^^^ - (Z/A./a,,Z)* 

is the surjectivity of the Weil pairing. By Lemma we conclude that 

Now we verify (|24p . First let N be any positive integer and suppose M^^f f 
N. If Gm{E) C Gi2(Z/A^Z) then E has some minimal exceptional number d 
dividing N. Clearly d cannot be equal to the Serre number Ma^^, so again by 
Lemma[20]and the assumptions on E from Lemma[5]we arrive at a contradiction. 
Thus, if A/a,^ f iV we have 

Gn{E) = GL2{Z/NZ). 

Now suppose MA,f \ N. We apply Lemma [22l with Ga — tt^^/^ (-^Ma )j 
and Gb = Gn{E). The verification of the conditions on Ga and Gb are almost 
identical to those done in the previous paragraph, so we omit them. We conclude 
in this case that Gn{E) — 7r^\/^ {Hm^ )■ 

We have shown that for any elliptic curve satisfying the hypotheses of Lemma 
[5] that ((23)) and ([24]) hold, and so our proof of Lemma [5] is now complete. 



7 Almost all elliptic curves are Serre curves. 

We now show how Lemma [5] and Theorem [2] together imply Theorem |4l 
For N e {4, 6, 8, 9, 12, 24} define 



'{Ec,G{X) 
eN{X) := { {EeG{X) 
{E e G{X) 



E is minimal exceptional at \i N ^ {4, 9} 

[GL2(Z/8Z) : G8(£;)] = 2 if = 8 

Gn{E)(^Hn} if A^e {6,12,24}. 



By Lemma O we have that the set of non- Serre curves G„5(X) d C{X) satisfies 



Gns{X)Qe{X)[j\ U eN[X) 

^Are{4,6,8,9,12,24} 

By (121), to prove Theorem [5] it suffices to estimate the sets £m{X). 
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Definition 24. Let W he any integer and let {t, d) € (Z/H^Z)^ be any pair of 
integers modulo W with d G (Z/VFZ)*. Suppose that G C G'L2(Z/VFZ) is any 
subgroup. We say that G represents the pair (t, d) if there is a matrix g G G 
satisfying 

tr{g)=t, det{g)=d. 

The next two lemmas guarantee that when an elhptic curve fails to be a Serre 
curve by being exceptional at N, there must be some pair (t, d) not represented 
by Gn{E). 

Lemma 25. Let W > 2 be any positive integer and let 

X ■■ GL2{Z/WZ) {±1} 

be any nontrivial real character. Suppose that G C kerx is any subgroup. Then 
there exist integers t and d modulo W so that the pair {t, d) is not represented 
by G. 

Proof. Lemma [TOl implies that x is either of the form 5 o det or e ■ S o det, where 
6 is nontrivial and the second possibility may only occur if W is even. Choose 
any / G (Z/WZ)* with 

and set = (1,/). □ 

Lemma 26. Let p = 2 or 3 and suppose G C G'L2(Z/p^Z) is a subgroup which 
represents every trace- determinant pair (t,d) G (Z/p^Z) x (Z/p^Z)* and which 
surjects onto GL2{Z/pZ). Then, G = Gi2(Z/_p^Z). 

Proof. We consider the intersection 

of G with K = the kernel of the projection 

GL2{Z/p^Z) — > GL2{Z/pZ). 

Our goal is to show that G actually contains K. From here we divide the 
argument into cases, according to whether p is 2 or 3. 

Case: p = 3. Under the given hypothesis, we may find a matrix g (z G with 
tv g = 3 and detg = 1. Such a matrix must have the form 

— ■ o).(; O'G 1)4 > 
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and the (mod 3) coefficients of the matrix Y = ['^ ^1 satisfy the conditions 



c d 

a + d=l, b-c=lif X 
a + d^l, 6-c = 2ifX 
d = Q, a + b + c-d = OiiX 
d = 0, a-b-c-d = 2ifX 
d = 0, a-b-c-d = OifX 
d^O, a + b + c-d^liiX 



1 

2 

2 

1 

1 1 

1 2 

1 2 

2 2 

2 1 

1 1 

2 2 
2 1 



In each case, the first equation comes from the trace condition on g and the 
second one comes from the determinant condition. One computes: 

{X + 3Y)^ = I + 3X mod 9. 

Since in this case the discriminant — Ad = 5 is nonzero modulo 3 we see 
by Lemma [11] that all six of the matrices X , when reduced modulo 3, are 
GL2(Z/3Z)-conjugate to one another. From this and the fact that the various 
X span the Z/3Z- vector space M2(Z/3Z) we conclude that 

GnX = / + 3M2(Z/3Z), 

i.e. that K C G, and so G = Gi2(^/9Z) in this case. 

Case: p = 2. The proof in this case is similar. Pick g E G with tr g — 2 
and det g = —1. Then g must have the form 

l\ fl l\ fl 0\t fa b 



Y = 



c d 



where the (mod 2) coefficients of the matrix Y satisfy the conditions 
a + (i = 1, fe + c = if X = 

a + d = Q,a + c + d= liiX = 

a + d = 0, a + 6 + (i=lifX = 



1 

1 

1 



1 
1 1 

(The possibility X = I+2Y is eliminated since the conditions on the coefficients 
of Y in that case read a + d ^ 0, a + d = 1.) One computes: 

{X + 2Yf = I + 2X mod 4. 
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After conjugating by preimages of elements of Gi2(Z/2Z), one concludes that 

Gni^D{/ + 2.span|(^J , (^J 

Playing the same game with t = and d = 1, one sees that in fact 

Gn if D { traceless matrices }. 

Now G can be at worst an index 2 subgroup of GL2(Z/4Z). However, if G is 
indeed a proper subgroup of index 2, we may apply Lemma [25] and arrive at a 
contradiction. This concludes the proof in this case. □ 

Lemmas 1251 and 1261 implv the following corollary. 

Corollary 27. For N £ {4, 6, 8, 9, 12, 24}, we have 

£n{X) = [J £N,{t,d)iX), 

{t,d)e(Z/NZ)x{Z/NZY 

where 

£N,{t.d) ■— {E G eN{X) : {t,d) is not represented by GNiE)}. 
Lemma 28. For each N e {4, 6, 8, 9, 12, 24}, we have 

\eNiX)\ <^N^^X^maxTT{X;N,d)-^, 

d 

with an absolute implied constant. 

This lemma and its proof are analogous to Lemma 5 of f7J , whose statement 
contains a small error: the "<C X^tt{X; N,d)~'^" should be replaced by "<C 
iV4x6maxd7r(X;iV, 

Using the Siegel-Walfisz theorem (c.f. , p. 133), which gives 7r(X; N, d) > 
iipiN)yW{X), Theorem 1 follows. 

8 = 4 occurs as a minimal exceptional num- 
ber. 

If = 4 or 9, the argument given in section [TS] is invalid since we may not 
conclude that ((20|) holds. In fact, there is a subgroup H C Gi2(^/4Z) of 
index four which satisfies conditions p7|) and p^ . We now describe H and 
demonstrate an infinite family of non-isomorphic elliptic curves E for which 
Gi{E) = H . Elkies 9 has recently exhibited similar examples for = 9. 

First, a geometric description of H: Let L be a complex lattice and let L[A\ 
denote the 4-torsion of C/L. By choosing a basis, we may identify i[4] with 
(Z/4Z)^. Let li,l2 ■ ■ ■ jle denote the lines through the origin in £[4]. More 
precisely, define the equivalence relation on L[4] by declaring u ^ u' exactly if 
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u' = \u for some A G (Z/4Z)* = {±1} and denote the resulting equivalence 
classes by li,l2 ■ ■ ■ Je- Since the Weierstrass p-function is even, the association 
li = [u] p{u) identifies ¥{{Z/4Zf) := {h,l2,---,k} with £[4]^, the set of 
a;-coordinates of the 4-torsion oi E = E^, the elliptic curve associated to the 
lattice L. This correspondence identifies the Galois group of Q(-E'[4]a;) over Q 
with a subgroup of PGL2(Z/4Z). 

We may extend the natural action of PGL2(Z/4Z) on P((Z/4Z)2) to obtain 
a PG'i2(Z/4Z) action on the set 

^i2) ^13}) {^145 ^15) ^ie}} • S'll € {1,2, ...,6} are distinct}. 

This action is not transitive. The size 10 set S decomposes into two orbits Si 
and ^2 of sizes 4 and 6, respectively. To describe these sets, one needs to define 
an "addition relation" on P((Z/4Z)2). If l^, l^, and ^3 are lines in P((Z/4Z)2), 
we say that 

h+l2 = h 

exactly when, for some choice of representatives Ui € U we have 



Ml + W2 = M3- 



(Note: This is a relation, not a well-defined operation. For example, [(1,0)] + 
[(0, 1)] = [(1, 1)] and [(1,-1)].) Then the two orbits are defined by 

'S'l := {{{^ii ) li2 J ^13 }) {^U 5 ^is J ^16 }} ^ • hi "I" ^12 ~ hi } 

and ^2 = S — Si. Fixing any element r e 5i we define = Hx{r) C 
PGL2(Z/4Z) to be the stabilizer of r. Finally, we define H = H{r) to be 
the preimage of Hx under the natural projection GL2{1,/A'L) PGL2(Z/4Z). 

To find elliptic curves E with Gi{E) = H, we reason as follows: let xi, X2, 
. . . , a;6 be the elements of £^[4] a,. HE is given in the form 

E: y'^=4x^- g2X - 33 

then the minimal polynomial for a;i, X2, . . . , a^e is given by 

fE{t)-t - —t -5g3t - —t - —t+ ^ . 

The set Si defined above corresponds to the set of numbers 

where © refers to the addition law on E. Xi is a set of four complex numbers 
which satisfy the (generically irreducible) polynomial 

hAt) =t' + 3g2t' + + (^ + 108gl)t + 
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Wc note that Gi{E) C some H{r) whenever fi,E{t) has a hnear factor over Q. 
Let s G Q and denote by Es the eUiptic curve given by the equation 

2 , 3 16s2 + 56s + 81 (16s2 + 56s + 81)2(-l + 4s) 
3s 864s^ 

It may be checked that for each s, fi^Esit) is divisible by t + 27 + + -yS^ 
and that 

Gal{Q{EMms)) - H. 
The discriminant is computed to be 

. ^ (16s^ + 56s + 81)3(4s + 3)^ 
^ 27648s4 

and the j-invariant is 

1769472s 
~ (4s + 3)4- 

In particular, if we apply the Hilbert irreducibility criterion, we see that there 
are infinitely many non-isomorphic curves Es, each with Galois group G4 ~ iJ. 
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